Can we set the path of kernel probe symbol files?

[fripSide]

I try to run bpftrace on container. It cannot access the /sys/kernel/debug/tracing directories. The bpftrace failed to install hooks due to cannot resolve the correct symbol name from the kernel probe symbol files. In fact, it does not need to parse these files if we just use the correct symbol names exactly the same with the kernel symbols.

$ulimit -l 8192
$./bpftrace -e 'tracepoint:syscalls:sys_enter_execve { printf("%s called %s\n", comm, str(args->filename)); }'
$ls /sys/kernel/debug/tracing/

ERROR: Unknown error -1: couldn't set RLIMIT_MEMLOCK for bpftrace. If your program is not loading, you can try "ulimit -l 8192" to fix the problem
stdin:1:1-37: ERROR: tracepoint not found: syscalls:sys_enter_execve
tracepoint:syscalls:sys_enter_execve { printf("%s called %s\n", comm, str(args->filename)); }
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
ls: cannot access '/sys/kernel/debug/tracing/': No such file or directory

Can the bpftrace use another path to get these symbols?
Such that we dump the tracing symbols and put it in the same path with bpftrace. I think some people may also have this need.
Is it a good idea to modify the source code and implement my own version and send a pull request to bpftrace?

// https://github.com/iovisor/bpftrace/blob/master/src/tracepoint_format_parser.cpp#L113
// 1. first search the kernel path
// 2. if failed, try to use the local path
std::ifstream format_file(format_file_path.c_str());
if (format_file.fail())
{
   format_file = std::ifstream("local_path/events/trace").
}
if (format_file.fail()) {
   // error failed to find
}

[viktormalik]

Can the bpftrace use another path to get these symbols? Such that we dump the tracing symbols and put it in the same path with bpftrace.

Unfortunately, that won't be possible here. The tracing subsystem (/sys/kernel/debug/tracing) must be mounted to be able to attach to tracepoints. With a local file, bpftrace could possibly parse some information - tracepoint format, etc., but the attachment wouldn't be possible.

Is it a good idea to modify the source code and implement my own version and send a pull request to bpftrace?

Yes, it is always a good idea to do so for anything potentially useful :-)

[viktormalik]

For running bpftrace in a container - you need to mount tracefs (-v /sys/kernel/debug/tracing:/sys/kernel/debug/tracing) and possibly some other directories for searching types. Check how we do it in CI.